Reading this guy's posts, his ego is the biggest issue, and it will be his downfall. The "I literally can't get caught" mentality inevitably leads to carelessness and blabbermouthing.
Now major criminals launder money to avoid that.
At least in my mind leaving some false trails behind, when I run through scenarios, seems like it could leave actual trails / to the point of not being worth the extra risk.
All about plausible deniability. Layers and layers and layers of dead ends that seem real.
In this way, if you do actually slip up, it becomes near impossible to distinguish the real slip-ups with the orchestrated ones.
- if the false slip-up used only public information about, you likely don’t have access to confidential information about that space. If it used confidential information, you do.
- The geography and demographics of the false lead are probably not near-misses. The point of misdirection is to misdirect, so you likely won’t frame a coworker that will bring investigators to your own door.
- Any mistakes in the false slip-up, from spelling to factual to timing, may reveal info.
IMO this is a “too clever by half” scenario: leaving any trace at all is information. Leaving none is wiser.
Example: you’re a master hacker. You’re going to repeatedly access a compromised system. Is it better to set an alarm for 3am each time to suggest you’re in a different time zone, or to use a RNG to close an alarm time?
I say the RNG is better. Using 3am gives psychographics. Random isn’t clear if there’s any planning at all, or if you travel, etc.
>
> “Epic opsec troll,” they claimed.
If this were really a fictitious persona meant to lead investigators away from their true identity, they'd never admit to such. This sounds like someone trying to deflect upon being found out. I'd wager that this person is going to be caught.
Krebs has an image of a mind-map at the end of the article showing links between the aliases.
This is called a "double cover story", a classic deflection when someone is caught or exposed.
[1] https://www.quantamagazine.org/why-mathematicians-still-cant...
You really need to watch this Key & Peele & Rocket Jump colaboration: https://www.youtube.com/watch?v=IHQr0HCIN2w
Actually, since I'm actually undercover as you, and I've already watched it...
that's what a super epic opsec troll would want you to think
In fact assuming someone to be truthful isn't a good prior, knowing that they may be "untrustworthy" doesn't tell me much, since I didn't start off thinking otherwise.
Watch The Princess Bride and you will find a wonderful scene about choosing the right cup there.
While it doesn’t really apply to this situation, it’s all to say that i disagree with you saying there’s only information in the truth.. There’s information in everything.
the picture of the army gear, for example, consists of gear that could be purchased at any surplus store. I'm not in the US but I could easy acquire that, and I know enough about exif data to be able to alter an image to use GPS coordinates at a US Army barracks in SK.
meanwhile if they were showing a picture of them sitting with, say, a 240B MG, or something that actually proves they're in the US Army I might believe them.
while bartending back in the day I used to have a coworker who, after a few drinks one night, eventually confessed she was a camgirl for a while. she went by April, who was really Stefani -- nether of which were her real names, but were just layers to keep stalkers off of her back. she had friends on the other side of the country take pictures of their dorm to help further the story. I totally believe a serious cracker would take similar precautions; OPSEC on OPSEC
> What they say should not calculate in what we believe to be true
rather than thinking about definitions of trust.
Or does it not apply to corporations? What's the distinction, if so? It certainly seems common to not to apply it to corporations.
Not sniping here, I actually think this is solid logic, maybe with some exceptions but generally applicable. I feel like it's so commonly and happily not applied when it comes to the above companies (and others) that I find it stunning to see it stated so clearly here.
For instance, a malicious actor, of even basic sophistication, coming from a Russian ip and occasionally using Cyrillic and missing grammatic artcles is probably not Russian. Similarly a malcious actor with a pseudonym including the term patriot, coming from a US IP and using terms like howdy probably is not American.
False attribution is a core lesson in malice 101.
It's not unheard of to apply some occam's razor just in case while keeping misdirection in mind. Even masterminds aren't perfectly rational actors that cross all their t's.
I was always surprised to see security researchers confidently attributing some attack to a specific group based on easily falsifiable things like localization, alphabet, time zone, coding "style", specific targets, etc.
Even if researchers can undeniably link one attack to a certain group (like when they publicly take responsibility) and can label their style accordingly, all those indicators become at least semi-public. If the researchers have access to them, so do other other actors who are free to fake or imitate them. The confidence is probably more for the media reporting.
Looks a lot better than getting pwned by some jackass American teenager. So if the attack came from a Russian IP, or used some Cyrillic characters or something like that, there's a "face saving" incentive to take that probable misdirection at face value.
- real attacker doesn't want to get caught
- victim doesn't want to admit being pwned by a script kiddy or petty criminal
- military-industrial complex needs foreign threat inflation to stay in business
- media loves the intrigue
The pushback would come from the foreign state being falsely slandered, but they never get a say anyways.
I generally agree with the quip about American patriot actors, mostly.
Years ago when I was in the US military I knew many Russian weapons systems better than their US/NATO counterparts and had developed a decent working vocabulary of Russian words and prefixes in that specific area because it was my job to study Russian equipment.
Of course, that doesn't include the image being a ruse for other schema.
When combined with the uses the claimed for their botnet, the person we're talking about leaves an impression of having emotional maturity of a 10 year old.
So, you might not be very far when it comes to non-technical skills.
That fits well with the position of US president or the currently richest person on Earth.
To prove their "credentials" that they are a real world "though guy", in the hopes of gaining social clout in among their peers.
Same reason why some posts classified information on Discord or War Thunder.
Everything your target does (including misdirection) gives or risks giving away information, and there's no way someone who is actually in control of events would blow a cover because even if you were 99% certain it was false, you would have to continually waste resources trying to confirm that. In particular if they invested a lot in building this persona and you were on to them it's much more likely they would just go dark, wait and plan how to pick up with a new persona.
Krebs knows about this timezone analysis technique, wonder if he didn't check this or it was inconclusive?
People have wacky schedules but it's about when you never work
You could do an analysis on HN comments.
It's very hard to fake, you'd have to schedule on all channels. For instance don't look at all of a users HN comment's just ones posted less than a hour after it was on the front page.
I always set the time zone on my PC to a fake one. It cause's havoc sometimes and it's not even close to enough. It's hard once someone is after you.
These guys always seem to have the most stereotypical or corny hacker handles. Is that expected / desirable in that community?
I see what you did there.
https://techcrunch.com/2022/03/02/snowflake-acquires-streaml...
Huggingface bought its biggest competitor, Gradio (still used more than Streamlit) for an "undisclosed" amount of money a year or so before hand. I'd wager HF paid on the orders of 1-5 million.
I know that's not exact, but if more people used Gradio, you'd expect at least a somewhat similar number of people searching for it online. Gradio is not even in the same ballpark as Streamlit here.
[1] https://trends.google.com/trends/explore?date=now%201-d&q=%2...
I don't claim you're wrong, but I claim that gradio is far more effectively profitable to know than streamlit is - i.e. Gradio demos are used far more for a top AI paper demo (i.e. NeurIPS system demos) than Streamlit is.
edit: okay fine I'll bite -- because of chicken piccata
It's kind of unfortunate for him that he didn't do a better job of referencing Beavis and Butthead. If his username was "Cornholio" or even "Bungholio", it could read as someone directly referencing the show and potentially unrelated to the other account, making his deniability a bit more plausible.
Perfect OPSEC to me, means near total isolation from socialization. Not something most people are capable of.
If you’re a professional criminal of any kind you weigh the risks knowing that perfection is impossible. The government is a business with a monopoly on violence. The goal is to keep their ROI for catching you as low as possible. Every single man hour spent finding you is costing money and there’s a man upstairs who wants to see some results that reflect the money spent.
Once you understand that premise, it’s easy to understand the why and how criminals are caught. The ones who are caught are always the ones who don’t know when to fold. Always the ones not to cash in and retire.
The ones who get away with it, they fold they retire and society forgets about them and the ROI drops precipitously on catching them. Research statistics on cold cases.
I think that's the key right there! ;-)
SBF levels of self-pwning right there. When, not if, they catch him, the Feds are going to hang this clown out to dry.
Therefore some data should either not be stored at all or deleted after it served its purpose.
Unfortunately, anything involving phones is based on literally decades of stuff that was made in a time where every participant in the network was trusted by default, and bringing up the legacy compatibility stuff to modern standards is all but impossible.
ss7 was developed almost a half-century ago, wasn't it?
IMEI 123456789 has ID sjkadnasf8uywjerhsdu, and then in the hyper locked down Mongo instance used by billing knows that sjkadnasf8uywjerhsdu relates to John Smith, credit card number xxxx xxxx xxxx xxxx
make it so you have to crack all of em, instead of just nailing one and walking out w/ all the crown jewels
- The "hacker" (I'm reluctant to use this term" seems to be too high profile for some reasons;
- We should discard Telegram
Making the change to start keeping exactly the data that the government has been asking them to turn over isn't a very good look. "Securing" user's data with something as week as a PIN isn't great either. https://www.vice.com/en/article/pkyzek/signal-new-pin-featur... Note that the "solution" of disabling pins mentioned at the end of the article was later shown to not prevent the collection and storage of sensitive user data. It was just giving users a false sense of security. To this day there is no way to opt out of the data collection.
Why the fuck did they make such terrible insecure defaults for backups? IMO they should not even be doing backups at all by default, what the fuck.
It’s just plain poor opsec, but I kind of expect that from someone with poor enough judgement to be a criminal.
But why? There is no better platform for private and small chats.
The guy seems arrogant, and arrogant = sloppy. He'll get caught.
And to pop that bubble of false confidence.
The way he acted, would be a very red flag for me, if I were to hire him. Maybe skillfull, but careless. And that is not acceptable in that line of work. (Neither it is in the military)
I assume the FBI or whomever has automated this to some degree already, and I really hope someone does a great writeup of how LLMs/agents can do even more.
Having worked with LLMs over the past year+ trying to get them to do useful things in various contexts, the real work is typically pretty boring data acquisition (e.g. scraping) + ETL and then making that data available to the LLM.
I can’t be the only person who has read of such situations throughout history.
Or maybe the real root is our tendency to fixate on simplistic reductions.
Can you explain your definition of "doxxing" and why you believe that means nothing he writes is serious?
Revealing people names and addresses and implying that they have done something illegal, while the person doing that (this Krebs guy) does not represent the Law/the relevant authorities. See the Boston bombings debacle on this very website.
> why you believe that means nothing he writes is serious?
See the Boston bombings debacle on this very website.
I'm familiar. I don't see the relevance considering that the linked article does not reveal anyone's names or addresses.
https://itwire.com/business-it-news/security/86867-infosec-r...
When I read "an investigative journalist is publishing information alleging criminal activity" my reaction was "so what?" What you linked is not that.
it's another layer of obfuscation. strippers telling you their name is April (but then whispering to you that their real name is Stefani)... but their real name is actually Angela, and it's just another deflection to keep off the stalkers.
same idea with IT OPSEC
I get the line of thinking, and I tend to agree that if they really wanted to, they could figure out a way to match the pattern of a uniform to the person if the person had published a picture of themselves wearing the article on something like Facebook.
But that's a big if. When I was in the military, I think I posted like one picture of me in camo and the resolution was so low that you probably didn't have enough detail to come to any conclusions.
If a civilian gets caught doing something illegal, they are entitled to a fair trial with a jury of their peers. If a military member gets caught doing the same thing, the court martial is a mere formality, they just more or less go straight to jail for a very long time.
This topic has been litigated a lot in front of SCOTUS like with Standard Form 86 (where one waives the right to free speech for security clearance) so there’s certain language they have to contain to be valid.
Courts have upheld this because Congress has the power to regulate the military, but it still feels like a huge shift in rights for someone forced to serve.
It feels... intuitively unjust that the government could compel service and then subject individuals to a system that limits their constitutional rights.
and unfair, considering that rich people always found ways to dodge the draft or serve in armchair positions, but taking this into account it's just even more obvious that special interests did what they usually do.